PhantomCall: Evading ML Malware Detectors via Function Call Graph Perturbation

1 Introduction

• Global cybercrime damages reached an estimated $10.5 trillion in 2025, while Windows accounted for approximately 87% of desktop malware detections that year.The paper uses these figures to motivate the importance of studying Windows malware detection.Source: §1 · p. 1
• The paper frames black-box malware evasion as a way to characterize production attack surfaces and inform more robust detectors, since attackers can modify samples while preserving functionality.The authors note that structured adversarial perturbations are a significant threat because ML detectors already largely resist classical obfuscation.Source: §1 · pp. 1–2
• Prior Windows PE attacks target bytes [32] [35], headers and overlays [13], or intra-function CFGs; FCG perturbation under black-box access remains understudied.Android [38] and WebAssembly approaches use dead calls or shortcircuiting stubs and do not tune injection configurations against the target classifier.Source: §1 · p. 2
• PhantomCall injects fully executable, reachable dummy functions at targeted call sites, adding CFG and FCG nodes and edges while preserving semantics, with classifier-guided search over tunable injection settings.The framework uses greedy and adaptive simulated annealing search, tuning injected-function count, perturbed call sites, and search iteration budget.Source: §1 · p. 2
• 85-100% attack success rate (ASR) across all configurations exceeded prior state-of-the-art by up to 14.78 percentage points on MalGraph and 95.5 percentage points on SAFE+GNN, with variants generated up to 2.9× faster on average.These results were measured on a 2025-collected Windows malware corpus against MalConv, MalGraph, and SAFE+GNN at 0.1% and 1% FPR thresholds.Source: §1 · p. 2
• ASR remained 84.5-100% for high-confidence detections, and 86-97% of evasive samples retained their original malicious functionality.Adversarial finetuning reduced ASR to 26-83%; structural heuristics achieved 100% detection at 9.5-17.4% false positive rates, but neither defense alone neutralized the attack.Source: §1 · p. 2

2.1 Malware Detection

• A detector maps a Windows PE executable to a maliciousness probability and flags it when that probability meets the deployment-dependent threshold.The feature function ψ maps the executable to a numerical vector, and f(m) = 1[P(m) ≥ τ_clsf].Source: §2.1 · p. 2

2.2 Adversarial Malware Generation

• Adversarial malware generation seeks a modified executable classified as goodware while remaining semantically equivalent to the original.Semantic equivalence means preserving the malicious payload and runtime behavior [11, 42].Source: §2.2 · p. 2
• Feature-space attacks perturb the feature representation directly, whereas problem-space attacks modify the raw executable to keep the adversarial sample runnable.Direct feature perturbations may not produce a valid executable.Source: §2.2 · p. 3

3.1 Threat Model

• The threat model gives the attacker only query access and predicted labels with maliciousness scores, and targets FCG detectors that recover internal direct calls to user-defined functions.FCGs based on external API calls, obfuscated push+return sequences, or computed indirect calls are outside scope.Source: §3.1 · p. 3

3.2 Problem Formulation

• The formal objective is to directly transform a Windows PE malware executable with semantics-preserving operations until its maliciousness score falls below the classifier’s threshold.The transformation sequence must achieve evasion while maintaining semantic equivalence.Source: §3.2 · p. 3

3.3 Challenges & Solution Outline

• To address PE-specific execution constraints, PhantomCall uses trampolines to inject fully executable dummy functions, changing both CFG and FCG structure while preserving program semantics.Injected functions must respect x86 calling conventions, register and stack state, relative addressing, and runtime reachability; function-body content and injection volume are tunable.Source: §3.3 · p. 3
• Because black-box classifier scores are scalar, non-monotonic, and architecture-dependent, PhantomCall’s search jointly tunes NOP content and call-site injection volume using classifier feedback.The algorithm family ranges from greedy exploitation to simulated-annealing exploration; instruction-sensitive classifiers may respond more to NOP variation, while node-aggregating classifiers may benefit more from larger injection volumes.Source: §3.3 · p. 3

4.1 Function Call Graph Perturbation Module

• PhantomCall redirects eligible internal calls through trampolines that call the original target, invoke k dummy leaves, and jump back to the original flow.It excludes Windows API and library calls; unlike prior displacement-based approaches, it adds executable functions and FCG edges alongside CFG changes.Source: §4.1 · p. 4

4.1.1 Dummy Leaf Functions

• Dummy leaves are parameterless, register- and memory-neutral functions whose bodies vary by target classifier.MalConv and MalGraph use prologue/epilogue-wrapped semantic NOP bodies; SAFE+GNN uses minimal ∼5-byte patterns because its pooled function embeddings respond less to body content.Source: §4.1.1 · p. 5

4.1.2 Graph Perturbation Effects

• Each injection adds k FCG nodes and caller-to-dummy edges, while also adding CFG blocks and changing the hijacked block’s ending to a jump.Each dummy body forms a basic block ending in ret, and the trampoline adds another block.Source: §4.1.2 · p. 5

4.2 Call Site Selection

• PhantomCall selects candidate call sites uniformly at random by default; tested structural and instruction-density rankings did not consistently outperform random selection.The evaluated rankings include raw degree, betweenness, eigenvector centrality, and local assembly instruction density.Source: §4.2 · p. 5

4.3 Classifier-Guided Injection Search Module

• The search module chooses call sites and semantic NOP sequences to minimize classifier maliciousness scores, with configurable per-site depth and site coverage.It compares greedy exploitation with simulated annealing, which can accept worse moves to escape local minima.Source: §4.3 · p. 5

4.3.1 Greedy Search

• Greedy search keeps the best immediate score reduction at each site but never accepts worse intermediate states, so it can stall in local minima.It patches candidates with PATCHATCALL and queries the classifier, returning a bypassing binary or the best non-bypassing sample.Source: §4.3.1 · pp. 5–6

4.3.2 SA-Inspired Search Algorithm

• Simulated annealing treats maliciousness probability as energy and probabilistically accepts worse NOP choices, while propagating only each site’s best candidate to the global state.It uses exponential or adaptive cooling; SAFE+GNN allocates more search budget to outer call-site iterations than inner NOP search.Source: §4.3.2 · p. 6

4.3.3 Binary Patching

• Adversarial binaries place relocated calls, NOP blocks, and trampoline jumps in a new PE code section aligned to 4 KB.The MalGuise baseline is also evaluated with the same new-section configuration for a fair comparison.Source: §4.3.3 · p. 6

5.1.1 Target Systems Details

• The evaluation targets MalConv, MalGraph, and SAFE+GNN, using 2025 MalwareBazaar malware pools of 559/3,662, 2,605/3,234, and 1,000/1,000 samples at 0.1%/1% FPR, respectively.SAFE+GNN is trained from scratch on a separate 2024 corpus; all evaluation pools are disjoint from the 2025 test set.Source: §5.1.1 · p. 7, §5.1.2 · p. 7

5.2 Evaluation Metrics

• The study measures attack success rate, semantic preservation rate, and successful bypasses per hour; implementation uses IDA for analysis and LIEF2 and pefile for binary injection and call-site overwriting.PhantomCall is implemented in Python and evaluated on a server with 3 RTX 3090 GPUs, 252 GB RAM, and 48 processors; patching requires no instruction relocation or reference fixup.Source: §5.2 · p. 8, §5.2.1 · p. 8

5.3.1 RQ1: Attack Effectiveness against Target Classifiers

• Up to +14.78 pp ASR and 1.85× throughput over MalGuise on MalGraph; on SAFE+GNN, PhantomCall reaches 85–97% ASR versus MalGuise’s <2%.Against MalConv, the methods achieve comparable ASR, while PhantomCall is 1.43–3.5× faster; SRL has near-zero ASR against SAFE+GNN because its CFG mutations do not alter FCG topology.Source: §5.3.1 · pp. 8–9, Table 1 · p. 8

5.3.2 RQ2: Ablation Studies and Attack Footprint

• Removing FCG perturbation cuts MalGraph ASR by 7.37–10.15 pp and SAFE+GNN ASR from 97.4% to 0.9% at 0.1% FPR and from 85.0% to 0.1% at 1% FPR.For MalConv, FCG perturbation adds at most 1 pp ASR; iterative NOP search improves ASR by ∼26–62 pp across MalConv and MalGraph configurations.Source: §5.3.2 · p. 9
• Across MalConv and MalGraph, 65–80% of evasions require one call-site modification, while SAFE+GNN needs median byte overhead of 5.0% at 0.1% FPR and 16.5% at 1% FPR.For SAFE+GNN, ASR rises from 3.8% at k=1/3 to 84.2% at k=2,500/3,500, with injected byte overhead increasing from 2.7% to 15.3%; larger injection volumes shift the pooled representation but increase footprint.Source: §5.3.2 · p. 10

5.3.3 RQ3: Injection Topology and Hyperparameter Sensitivity

• DAG-constrained chaining degrades ASR by up to 2.5 pp on MalConv, 5.5 pp on MalGraph, and 34.30 pp on SAFE+GNN; MalGraph also requires diverse NOP types.SA temperature varies ASR by less than 0.6 pp; restricting MalGraph to k=1/1 lowers ASR by 11.5 pp, while configurations with k ≥3 are within 1.7 pp of each other.Source: §5.3.3 · p. 11, Table 4 · p. 11

5.3.4 RQ4: Semantic Preservation Analysis

• Semantic preservation is assessed by comparing sandbox-observed Windows API-call sequences and calibrating an equivalence threshold from each sample’s own run-to-run variability.Each adversarial sample receives one sandbox run and its original receives two; the comparison uses length-normalized Levenshtein distance.Source: §5.3.4 · p. 11
• PhantomCall preserves original malicious behavior in 86–97% of evaluated bypasses: 93–97% for SAFE+GNN, 90–93% for MalGraph, and 86–87% for MalConv.Across 1,706 evaluated samples, 147 (8.6%) failed preservation; MalConv and MalGraph failures were dominated by overlay-dependent malware, while SAFE+GNN had fewer failures (28 out of 595 vs. 119 out of 1,111) and mostly short traces.Source: §5.3.4 · p. 12

5.3.5 RQ5: Defense Robustness

• At 1% FPR, finetuning cuts ASR by 18.9 pp (99.9%→81.0%) for MalConv, 14.4 pp (97.1%→82.7%) for MalGraph, and 58.7 pp (85.0%→26.3%) for SAFE+GNN.For MalConv and MalGraph, evasion then requires 2–3× more call sites and a 2.73–4.41× throughput reduction; SAFE+GNN’s median cost remains 4 call sites and ∼9 byp/hr. Residual ASR is 26–83%.Source: Figure 5 · p. 12, §5.3.5 · pp. 12–13
• Hleaf achieves 99.9% TPR at 0.1% FPR on leaf variants, but DAG injection reduces detection to 10.5%; Hany catches all samples at 17.4% FPR, while Hall detects only 1.7% of DAG variants at 0.1% FPR.Hsect flags every adversarial sample but also flags 9.5% of benign executables; Hsize detects only 25% of adversarial samples. The threshold sweep does not resolve the tradeoff.Source: Table 6 · p. 12, §5.3.5 · pp. 12–13

6 Related Works

• Prior approaches manipulate API calls [14] [23], CFGs, source code, binary bytes [16] [32] [35], headers or overlays [13], and binary diversity.Reinforcement learning has also searched transformation spaces using surrogate models, policy distillation, or semantics-preserving Deep Q-Networks.Source: §6 · p. 13
• Android, WebAssembly, and IoT FCG attacks use dead edges, simple call injection, function insertion, call-site redirection, or branch-function injection [38].Managed runtimes or intermediate representations abstract calling conventions and stack management, making these FCG modifications substantially simpler than in compiled Windows PE settings.Source: §6 · p. 13
• PhantomCall injects reachable, fully executable dummy functions with configurable body content and injection volume, simultaneously changing Windows PE CFG and FCG structure while preserving problem-space validity.This matters as SAFE+GNN and FCGAT increasingly use FCG structure as a primary discriminative feature.Source: §6 · p. 13

• Across three architecturally distinct classifiers, PhantomCall achieves 85-100% ASR while preserving malicious functionality in 86-97% of evaluated samples.Source: §7 · p. 13
• NOP content diversity drives evasion for instruction-level classifiers, whereas injection volume governs less content-sensitive architectures; adversarial finetuning and structural heuristics reduce but do not eliminate the attack.Source: §7 · p. 13
• Because injected functions are parameterless and structurally simple, future work could enrich their bodies, target attention-weighted graph classifiers, and distinguish inert injections from legitimate code.Proposed enrichments include benign API calls, conditional branches, and local variables; another direction is targeting learned attention weights.Source: §7 · p. 13

Ethics Considerations

• Experiments used known MalwareBazaar samples in a static-only pipeline; variants were not executed outside isolated environments, distributed, or publicly released.Only cryptographic hashes of original samples will be shared for reproducibility; the research involved no human subjects and required no IRB approval.Source: Ethics Considerations · p. 18

A.1 SAFE+GNN: Architecture and Training Details

• SAFE+GNN combines FCG structure with learned function embeddings and reported F1-scores of 98.27% on MalwareBazaar and 98.31% on BIG-2015.The original evaluation used ten-fold cross-validation on 3,927 MalwareBazaar samples across 6 families and 10,810 BIG-2015 samples across 9 families.Source: §A.1 · p. 19
• The adaptation changes SAFE+GNN from family classification to binary malware detection and uses IDA Home for FCG extraction and a 20,000-sample 2024 corpus.IDA Home replaces Ghidra to match the MalConv and MalGraph evaluation pipeline.Source: §A.1 · p. 19
• Because the available pretrained SAFE encoder targets AMD64 while the corpus contains x86 binaries, the adaptation uses 100-dimensional Word2Vec CBOW embeddings trained for 100 epochs.Instruction embeddings are mean-pooled into function vectors; tokenization normalizes numeric constants to N, and a minimum count of 5 yields a vocabulary of 4,817,392 tokens.Source: §A.1 · p. 19
• The graph model uses three mean-aggregation SAGEConv layers with hidden dimension 64, LeakyReLU, dropout rates 0.2/0.3/0.4, global mean pooling, and a 64→2 classifier.The model has 29,506 parameters.Source: §A.1 · p. 19
• Training uses AdamW with learning rate 0.005, weight decay 0.01, cross-entropy loss, batch size 128, and validation F1-macro early stopping with patience 50.The best checkpoint was selected at epoch 100 and evaluated on 2,000 held-out samples, split evenly between malware and benign files.Source: §A.1 · p. 19

A.2 PATCHATCALL Implementation Details

• The PATCHATCALL procedure patches a call site c with semantic NOPs.Source: §A.2 · p. 19
• PATCHATCALL allocates a contiguous region at a given RVA, computes the trampoline VA as imagebase+RVA, and places dummy function bodies sequentially after it.Each dummy function's VA is determined by accumulating the sizes of preceding bodies from the trampoline's end.Source: §A.2 · p. 19
• The original 5-byte call is overwritten with a same-sized jmp to the trampoline, and all call and jmp operands use 5-byte near-relative instructions.Source: §A.2 · p. 19

A.3 Call-Site Ranking Strategies

• The strategies rank candidate call sites before NOP search using assembly-level instruction density or structural CFG centrality.Both derive their ranking signals from the malware binary.Source: §A.3 · p. 19

A.3.1 Instruction-Density Ranking

• Prior studies used assembly code-based instruction-density features to identify malware-informative regions; the method ranks call sites by these signals to prioritize perturbation at classifier-sensitive locations.Source: §A.3.1 · p. 20
• Each call site is centered in a fixed-size assembly window, scored using normalized densities of arithmetic, logic, and transfer instructions.Windows are collected via IDA Home; feature counts and ratios are min-max normalized, and normalized feature counts are summed into the score.Source: §A.3.1 · p. 20
• After discarding windows below min_inst, the method sorts by score, suppresses windows with over 50% overlap, and returns the top-Kw call sites.If fewer than Kw windows remain after non-maximum suppression, it returns all remaining windows.Source: §A.3.1 · p. 20

A.3.2 Structural CFG Centrality Ranking; A.4 Greedy Search Algorithms

• Call-site centrality is computed on the containing CFG basic block, with the top 20 sites selected; Greedy retains the lowest-scoring candidate per site.The ranking distinguishes call sites within the same function, while the greedy outer loop proceeds across candidate sites.Source: §A.3.2 · p. 20, §A.4 · p. 20, §A.5 · p. 21

A.6 Dataset Construction Details

• The study collected 20,456 x86 Windows PE malware samples from MalwareBazaar’s 2025 submissions and partitioned them into three classifier-specific attack pools; their sizes are not specified here.SAFE+GNN required a dedicated training corpus: 14,000 x86 Windows PE malware samples were collected from MalwareBazaar for 2024, yielding 10,000 usable samples after filtering.Source: §A.6 · pp. 21–22

A.8 High-Confidence Subsample Analysis; A.7 Traditional Obfuscation Tools

• ASR remains above 81% across high-confidence cutoffs, while UPX and Enigma achieve at most 3.76% ASR across configurations.MalConv’s ASR is 97–100% under confidence filtering; both traditional tools have negligible success, and packing can harm MalGraph by destroying function boundaries and producing degenerate graphs.Source: §A.8 · p. 23, Table 12 · p. 23, §A.7 · p. 23

A.9 Malware Family Overlap Analysis

• 72–74% of SAFE+GNN test families overlap with training, accounting for 95–97% of labeled test samples.The authors conclude the attack set is not dominated by unseen families, making family novelty unlikely to explain the observed ASR.Source: §A.9 · pp. 23–24, Table 13 · p. 24

A.10 Search Strategy Convergence Efficiency Additional Details

• At 1% FPR, SA achieves 24.2% single-perturbation evasion versus 15.9%; at 0.1% FPR, it achieves 51.4% versus 44.8%.Source: §A.10 · p. 24

A.11 Call-Site Ranking Results

• For MalGraph, Betweenness↑ improves ASR by 3.2 pp at 1% FPR but costs 4 byp/hr; Degree↑ adds 1.28 pp and 6 byp/hr.For MalConv, ranking changes ASR by only ±0.25 pp, while Eigenvector↓ yields the largest throughput gain, +29 byp/hr at 1% FPR.Source: §A.11 · p. 24, Figure 8 · p. 24, Figure 9 · p. 25

A.12 DAG-Constrained Injection

• DAG-constrained injection augments dummy function bodies with calls to their child functions while retaining the trampoline structure.The procedure constructs an acyclic graph by adding edges in randomized order while excluding self-links and ancestors.Source: §A.12 · p. 25

A.13 SA Temperature Sensitivity; A.14 Semantic NOP Variety Sensitivity

• Across SA initial temperatures 0.3–1.2, MalGraph ASR varies by less than 0.6 pp and MalConv remains unchanged; NOP-variety tests vary s and r with s×r≈300.For MalGraph, temperature 1.2 adds 5 bypasses/hour; the supplied passages describe the NOP-variety experiment but do not report its outcomes.Source: §A.13 · p. 25, Figure 10 · p. 25, §A.14 · p. 25

A.14 Semantic NOP Variety Sensitivity

• 96.27% to 5.34% ASR for MalGraph when the diverse NOP pool is replaced by one instruction type shows pool diversity is critical, while MalConv retains 99.5% ASR.For MalGraph, using one NOP type per injection step instead of the default variety reduces ASR by 18.2 pp, while throughput reaches 39 byp/hr at s=7 versus 15 byp/hr at s=1. For MalConv, the single-type default achieves 100% ASR; at s=7, ASR falls by 6.26 pp and throughput is 239 versus 945 byp/hr. Replacing the pool also reduces MalConv throughput from 945 to 612 byp/hr.Source: §A.14 · pp. 25–26, Table 14 · p. 26

A.15 Dummy Function Count Sensitivity

• 11.5 pp lower MalGraph ASR at k=1/1 than the default contrasts with stable ASR for k≥3; MalConv remains at 99.5% across tested values.At k=7/7, MalGraph ASR is 1.7 pp above the default 1/3, which is retained for its minimal structural footprint. SAFE+GNN uses kmin/kmax=2500/3500; its k-range sensitivity is analyzed separately.Source: Figure 12 · p. 26, §A.15 · p. 26

A.16 Semantic Preservation Failure Analysis

• 147 of 1,706 samples (8.6%) failed semantic-preservation testing, with overlay-dependent failures dominating MalConv and MalGraph but not SAFE+GNN’s diverged failures.For MalConv and MalGraph, 52 of 54 diverged failures had overlays and 51 imported self-reading APIs, consistent with shifted overlay offsets. SAFE+GNN had 28 failures among 595 samples, versus 119 among 1,111 for MalConv and MalGraph; its diverged failures were not overlay-dominated, and the authors suggest large structural footprints may affect path-dependent behavior.Source: §A.16 · pp. 26–27

A.17 Analysis with Antivirus Engines

• 14–18% ASR against commercial engines for PhantomCall compares with 15–16% for MalGuise, while both reach 74–75% against ClamAV.Commercial-engine results differ by 1–3 percentage points per engine; the authors attribute ClamAV’s higher ASR to modified regions disrupting byte-pattern signatures.Source: Table 16 · p. 27, §A.17 · p. 27

A.18 Structural Heuristic Defense: Extended Analysis

• Reducing Hsize false-positive rate below 8% pushes its true-positive rate below 10%, while inter-dummy edges reduce Hleaf to 0% for SAFE+GNN.With roughly 3,000 functions per site, SAFE+GNN’s DAG variant gives every injected function at least one call; with k=1–3, some MalConv and MalGraph functions remain leaves. Hleaf flags injected sections containing only leaf functions.Source: §A.18 · pp. 27–28, Table 17 · p. 28

A.19 Attack Mechanism Analysis and Feature Space Visualization

• 4.4 to 0.4 mean L2 norm for SAFE+GNN contrasts with 81 to 191 for MalGraph, as injection shifts their pooled representations in opposite directions.Figure 13 shows MalConv adversarial representations partially overlap the benign region, especially at 0.1% FPR; SAFE+GNN shifts away from the malware cluster through mean-pooling dilution, while MalGraph’s max pooling inflates embeddings into a distinct high-magnitude region. MalGraph’s injected functions contribute directly to its pooled program embedding; SAFE+GNN requires sufficient injection volume to shift its mean-pooled representation past the decision boundary.Source: §A.19 · p. 28, Figure 13 · p. 29